Privacy Notice
1. Who is responsible for your data
The data controller is the business named on our order page, which runs Nyumbani Beats. Our address is .
For privacy requests, use the contact options on our order page.
We are registered with the Office of the Data Protection Commissioner, registration number .
2. What we collect and why
| What | Why we use it |
|---|---|
| Your name, WhatsApp number and optional email | To identify your order, message you about it and deliver your song |
| Your story, the names in it, how to pronounce them, and your genre, language and voice choices | To write your lyrics and produce your song |
| A voice note or a recording of a name, only if you record one with your story: your recording and its length. A voice note is up to 2 minutes; a recording of how to say the name of the person the song is for ("Say it") is up to 10 seconds. | To hear your story in your own words and how the names sound, while we write and produce your song. Only our team working on your song listens to it; we never put it into AI tools. If you record one but do not finish your order, we delete it after 24 hours, at our next daily clean-up (so within two days). It is deleted with the rest of your story when your data is erased. |
| The M-Pesa number you paid from, amount, receipt code and time. We never see your M-Pesa PIN. | To confirm payment, keep financial records and handle refunds |
| If you use Pay now: the M-Pesa number the prompt was sent to, the amount, the outcome (paid, cancelled, failed) and the times. Safaricom processes the payment itself and we never see your PIN. | To send the M-Pesa prompt, confirm the payment and match it if you tell us you paid. While a prompt is unpaid the attempt also holds the order you were placing, so a payment that arrives late is not lost; if the prompt ends unpaid we delete that order text after 24 hours, and we delete the whole attempt record after 30 days (the order keeps only the receipt and payer number described above). If a payment reaches us that matches no order, we keep only its M-Pesa reference, amount, date and the masked number, so that it can be refunded, and delete the record once it is settled. You can ask for access to, or erasure of, an attempt by either your own number or the number that was charged. |
| If you pay manually: the code from your M-Pesa message, the number you paid from, and your order as you sent it, story included, while we check the payment | To find your payment in our own M-Pesa records before we start on your song. Once we confirm it, it becomes your order like any other. If we cannot confirm a payment within 14 days, we delete it and everything sent with it. You can send a corrected code from your order page. If someone else pays for you, the number they paid from is kept in the same way, only to match and record the payment. The number a payment came from can only check that payment on our order page (whether it arrived, the amount and when we confirmed it), never the song, the story or anything else in the order. "Ask someone to pay" sends them the payment details from your own phone; we do not see that message. If you pay in parts (up to 5 M-Pesa payments, for example from a committee), each part keeps its own code, amount and the number it came from. The number of a part sees only that part on our order page (whether it arrived, its amount, and why we could not find it if we could not) and gets a receipt for that part only, never the other parts, the song or the story. Your receipt lists every part, with each number masked (07** *** 678). When your data is erased, the numbers of the parts go and the codes and amounts stay with the payment record. If the whole amount is not found in time, the payment and everything sent with it are deleted as above, but each part we did find is kept as a refund record until we have refunded it, and then as a business record like other payments: its code, its amount, the number masked and the dates, nothing that names you. |
| Your order record: status history, our internal notes, links to your song, and the record of what you agreed to (version and time) | To run your order, prove your consent, and handle corrections or complaints |
| Family memories, only if you ask for them with a memories link from the story step: the name and occasion the link shows, the day it closes, and from each person who adds a memory their first name, their memory in words (up to 600 characters) and/or a voice clip (up to 60 seconds), and when they agreed. At most 40 memories per link, of which at most 10 with a voice clip. | To write your song with the memories you choose. The phone that made the link sees what comes in. Our team reads and hears the memories that go with your order when we make your song, and sees a link's memories when someone asks for theirs to be deleted; we never put a voice clip into AI tools. The people you ask never see each other's memories or your story. When you send your order, the memories you did not choose are deleted and the link closes. The rest are deleted once your song is made and the free-corrections time (7 days after it is ready) has passed, at our next daily clean-up, or when the order is cancelled, and with the rest of your data when it is erased. A link no order used is deleted 1 day after it closes. They are never in our backups. If you ask us for a copy of your data, it says how many memories went with your story and when, not the names, words or voices of the people who sent them: those are theirs to ask us about. |
| A delay notice, if your song runs late: the reason (from a short list), the new time and any note we write to you | To tell you honestly on your order page that your song is late, why, and when to expect it. The time we first promised stays on your order, so we are still measured against it. The note is cleared when your data is erased. |
| Notifications, only if you tap "Notify me" on your order page: the push address your browser gives us for that phone (a long random web address at your browser's push service, such as Google, Mozilla, Apple or Microsoft), two keys to encrypt what we send, the page language and when you turned them on. Never your number. | To tell that phone when we confirm your payment, when your lyrics are ready to approve, if your song is running late, when it is ready, and when your gift is first played. Each notification is encrypted and says only that, with no names and nothing of your story. At most 3 phones per order. Tap Turn off and we delete it at once; we also delete it once your gift has been played or 30 days after your song is ready, whichever comes first, or when the order is cancelled (at our next daily clean-up), when the push service tells us the phone no longer takes them, and with the rest of your data when it is erased. It is never in our backups. Notifications are a convenience and may not always arrive; we still message you on WhatsApp. |
| Your finished song: the audio files, the lyrics and the title, and any 30-second preview we share with you before the full song | To deliver your song to you and handle corrections. A preview is a track like the others: it plays only on your order page while we are making the song, through a link that stops working as soon as the song is ready. |
| Your answers while we make the song: whether you approved the lyrics we shared or asked for changes, the lines you pointed at and your notes, and whether you told us to carry on after a preview or what to change | To write and produce the song the way you want it. These are deleted with the rest of your story when your data is erased. |
| Your receipt: when you first open it from your order page | To give you a printable receipt for your payment. It shows the number you paid from masked (07** *** 678). The link to it works for 30 minutes and has no phone number in it, so a receipt you share or print opens that receipt and nothing else. The number a payment came from, if someone else paid, gets a receipt for that payment only: never the package or who the song is for. |
| The waitlist, only when we are not taking new orders and you ask "Tell me when you reopen": your first name, WhatsApp number, the package you have in mind, the page language and when you agreed. Never a story. | To send you one WhatsApp message when we take orders again. We delete it when you order with that number, after 30 days, or when you ask us (reply STOP to our message and we delete it and do not message you again). It is never in our backups. |
| An unfinished order, only if you tick "you may send me one reminder": your first name, WhatsApp number, package, occasion and language. Never your story. | To send you one WhatsApp reminder with a link back to your order, which is direct marketing you agreed to. We delete it when you order with that number, when you untick the box, or after 7 days, whichever comes first. Reply STOP and we delete it and do not message you again. |
| Codes: the code used on an order, your referral code, and a coded fingerprint of your number | To price your order, to stop a referral code being used by its own owner, and to give you a reward when someone uses your code. We never tell you who used your code, and we never tell them who you are. Erasing your data removes your referral and reward codes; the discount on a paid order stays with the payment record. |
| Your review, if you leave one: what you write and whether we may show it | To learn how we did and, only if you tick the box and we choose it, to show it on our order page with your first name and the occasion. Untick the box on your order page and it comes down straight away. Erasing your data deletes it. |
| A message before the song, only if you add one on the story step: the words (up to 300 characters) and/or a voice message of up to 30 seconds, recorded on your phone | To show it, or play it, on the gift page before Play, to the person the song is for. It is not part of your story: our team does not use it to make the song; only the owner can play the voice message, for support, and nobody downloads it. You can change or remove the words from your order page until the gift is first played, and delete the voice message at any time (it cannot be recorded again). A voice message you record but never send goes after 24 hours like a voice note. It is deleted with the rest of your story when your data is erased, and it is never in our backups. |
| From the gift page: the day the person first pressed Play ("Played"), the one-tap reaction they chose (a heart, thanks or a celebration), and, by their own choice, a voice reply of up to 20 seconds | To tell you on your order page that your gift was played, and to let them send something back. "Played" and the reaction are shared with you (and told to your phone if you turned notifications on). The voice reply is the recipient's own recording, made for you: you hear it on your order page, the owner can play it for support, and nobody downloads it. They can delete it from the gift page until you have heard it. It is kept with your order and deleted with the rest of your order's personal data when that is erased; it is never in our backups. |
| The gift link and reveal date: who the song is for, the "from" line you choose (or your first name), the date it should open, the song title, lyrics and audio | To let you give the song to the person it is for. The gift link works without a phone number, so anyone you send it to can open it; it never shows your number, email, story or receipt. It stays sealed until the reveal date and stops working if the order is cancelled or erased. Once the song has played to the end, the gift page also offers your referral code, so the person can send a song back to you (the "from" line is filled in as the name); you get your reward as for any referral. "Make a card" draws a picture on your own phone with the song title and their first name (and, only if you tick it, a square code to the gift page): nothing is sent to us. |
| The app code for your song (like NB-4H7P-K2QX), and a scrambled number for each phone that saved the song with it | To let you, and the person the song is for, keep it in the Nyumbani Beats app on up to 3 phones. The app makes a random number for the phone; we keep only a scrambled form of it, to count the phones, and never learn which phone it is. Anyone you give the code to can save the song, so share it like the gift link. Erasing your data deletes the code. |
| Your licence certificate: your name, the song title, the package, the licence scope and a licence number | To give you proof of your licence. It is shown only on your private order page; anyone you give the certificate to will see your name on it. Our public verification page shows the scope and issue date, never your name. |
| If you order on WhatsApp, by phone or in person: the same details above, typed in by our team from what you tell us, with a note of how you agreed to these terms | To record your order where there is no website form. The chat or call itself stays in that app; we keep only what the order needs. |
| If an order is cancelled and refunded: the refund amount, method and M-Pesa reference | To keep financial records |
| Tax invoices: the KRA eTIMS invoice number for your order and, only if you ask for an invoice in a business's or your own name, the KRA PIN you give us | Kenyan law requires an eTIMS invoice for every sale, and a business needs one with its PIN to claim the cost. We keep invoice numbers as long as tax law requires. Erasing your data removes the PIN from our records; KRA keeps its own copy of the invoice. |
| Technical data: your IP address in hosting logs, and a one-way scrambled form of it for abuse limits and login protection | To keep the service secure and prevent misuse |
| Visit counts: when you open our order page and reach each step of the order form, we add one to that day's total for the step, together with how you arrived (for example "search engine" or "WhatsApp", worked out from the link and the name of the website you came from), the page language and the package. No cookie, visitor ID, anything you type or the address of the page you came from is kept, so these totals cannot be linked to you. If your browser sends Global Privacy Control or Do Not Track, you are not counted at all. | To see where people get stuck when ordering and improve the page. We delete the daily totals after 400 days. |
| Data saved on your own device by this website (your unfinished form, your voice note, recording of a name or voice message for the gift page until your order is sent, the key to the memories link you made, your order details, and which orders that phone gets notifications for, with the number you follow them with; on the memories page, a code for each memory sent from that phone, so it can be taken back) | So you do not lose your progress and can track your order. You can clear it in your browser. |
You choose what to put in your story. If you do not give us the details we need, we may not be able to make your song.
If someone sent you a gift link. The page plays the song made for you and shows the message the sender left. When you first press Play, the sender sees "Played" with the day on their order page. Nothing else is sent unless you choose to: a one-tap reaction (which you can change or take back), and a voice reply of up to 20 seconds, recorded on your phone only when you tap. The reply is your own personal data: it is kept with the sender's order so they can hear it on their order page, the owner of this site can play it for support, nobody downloads it, and you can delete it from the gift page until the sender has heard it. After that, ask us with your gift link and we delete it. Do not record other people without their agreement.
If someone asked you for a memory. A customer who orders a song may send family and friends a memories link. If you add a memory, we keep your first name, your memory in words and/or your voice clip, and when you agreed, only to write that one song: the person who asked you sees what you send and chooses which memories go into it, and our team reads and hears those when we make the song, and sees what you sent when you ask us to delete it. Other people who were asked never see yours. Your memory is your own personal data, not the customer's: it is not in the copy of their data we give them if they ask, and you can ask us about it yourself. Ask only about the person the song is for, and do not record other people without their agreement. What we keep and for how long is in the table above: memories the person who asked does not choose are deleted when they send their order, the rest once the song is made, and a link nobody used 1 day after it closes. You can take your memory back yourself from the same phone until the order is sent ("Take it back" on the memories page). After that, or if you no longer have that phone, contact us as shown in section 1 with the link you used and your first name, and we will delete it. The rights in section 8 are yours too.
Orders placed on WhatsApp, by phone or in person are recorded by our team on your behalf. Before we do, we confirm with you that you agree to the Terms of Service, the licence and this notice, and we note how you agreed. Ask us for the Terms link at any time.
3. Sensitive personal data
The Data Protection Act treats some information as sensitive personal data. This includes marital status and family details, such as the names of a person's children, parents or spouse, as well as health, religion or belief, and ethnic or social origin. Stories for weddings, ruracio, tributes and birthdays often contain this kind of detail, and so can a voice note or a memory from family and friends.
We only use sensitive details to make your song, and only with your clear agreement, which we ask for with a tick box before you pay. Each person who adds a memory agrees with their own tick box. You can withdraw your agreement at any time by contacting us. If you do, we will stop using the details and erase them, but we may not be able to complete or refund a song already made (see our Terms).
4. Our legal grounds
- Contract: to make and deliver the song you ordered.
- Your consent: for sensitive details in your story, and for sending data outside Kenya as described below.
- Legal obligation: to keep payment and accounting records.
- Legitimate interest: to keep the service secure and prevent abuse, and to count anonymous visits to each step of the order form so we can improve it.
5. Who sees your data
- Our team. Authorised people use a protected dashboard to manage orders. Producers who write and make your song see your story, the names in it and your music choices, and hear your voice note or recording of a name if you made one, and the family memories you chose, only for the orders they are working on. They see the words of a message you leave for the gift page, but never its voice message, the reaction or the voice reply that come back from it. They do not see your phone number, email, payment details or consent record, and they do not message you. Each of us may turn on notifications in our dashboard on our own devices: they say only that something needs attention (for example "A payment is waiting for your check" or "A customer approved their lyrics"), never your name, number, amount or story, and a producer is told only about orders they work on. We keep each device's push address for that, at most 3 devices a person, and delete it when the device signs out, when the person signs out everywhere, or when their account is switched off. A short morning summary we send ourselves holds counts only (for example "2 songs due today"), nothing about any customer.
- Netlify, which hosts this website and stores order records, voice notes, recordings of names, family memories, and the voice messages and voice replies of gift pages.
- AI music and audio tools we use to produce your song. We enter lyrics and style instructions, which can include names from your story. We do not enter your phone number, email, voice note, recording of a name or anyone's voice clip.
- A file hosting provider that stores the audio files of your song. When you play or download your song, the file may be delivered from that provider.
- Safaricom M-Pesa for payments, and WhatsApp (Meta) for messages between you and us.
- Your browser's push service (Google, Mozilla, Apple or Microsoft, depending on your browser), only if you turn on notifications. It carries each notification to your phone, encrypted so that it cannot read it.
- The Kenya Revenue Authority (KRA), which receives the details of each sale through its eTIMS invoicing system, as the law requires: the amount, what was sold and, if you gave it, your KRA PIN.
- The Nyumbani Beats app, only if you choose "Open in Nyumbani Beats App". Your order ID, song title, lyrics and listening links are then passed to the app on your own device so it can save your song there. They travel in the link itself and are not sent to our server logs. If you save your song with its app code instead, the app sends us the code and its random phone number (see the table above), and we send back the song.
Our pages load no fonts, scripts or trackers from other companies. Our typeface is hosted on our own site.
We do not sell your personal data and we do not use it for marketing. We share it with others only when the law requires.
6. Sending data outside Kenya
Some of the providers above store or process data outside Kenya. We send data abroad only as needed to provide the service, and only with your agreement, which we ask for with the tick box on the story step. We choose providers that protect data under their own terms. If you do not agree, we cannot make your song.
7. How long we keep your data
We keep your order and story for as long as we need them to deliver your song, make corrections and handle any complaint. Then we erase them automatically: 12 months after your order is delivered or cancelled, our system removes your personal data by itself, every day, without anyone having to remember. We also keep weekly backup copies so a mistake can be undone; each copy is deleted after 8 weeks, so anything we erase is gone from every backup within 8 weeks too. We keep payment records for as long as the law requires us to. You can ask us to erase your story and contact details sooner. When we erase an order, we remove your name, numbers, email, story, voice note, recording of a name, the family memories that went with it, lyrics, song title, track links, notes (including the note on any delay notice), app code and the notification addresses of your phones. We keep only the payment record (order ID, package, price, receipt code and time), the record of what you agreed to, a checksum of the payment details, and a coded fingerprint of the number you paid from. The fingerprint is made with a secret key we hold and cannot be turned back into your number. We keep it so a disputed payment can still be matched without storing the number, and our legal grounds are the duty to keep payment records and our interest in resolving payment disputes. You can object to this, and we will consider your objection.
8. Your rights
Under the Data Protection Act you have the right to:
- be told how your data is used, which is the purpose of this notice;
- see the data we hold about you, and get a copy;
- object to us using your data;
- have wrong or incomplete data corrected;
- have your data erased, except where the law requires us to keep it.
To use any of these rights, contact us as shown in section 1. We will confirm it is you, for example by messaging the WhatsApp number on the order, and then act promptly and within the time the law requires.
9. Keeping your data safe
Our website uses encrypted connections. The order dashboard needs a password, sign-in sessions are protected and limited in time, and repeated failed sign-ins are blocked. No system is perfectly secure. If a breach affects your data, we will notify the Data Protection Commissioner and the people affected as the law requires, including within 72 hours where the law sets that deadline.
10. Children
Our service is for adults. We do not knowingly collect data directly from children. If your story names a child, you confirm that you have permission from their parent or guardian.
11. Complaints
Please contact us first so we can put things right. You also have the right to complain to the Office of the Data Protection Commissioner of Kenya (odpc.go.ke).
12. Changes to this notice
We may update this notice. Each order records the version you agreed to. If we change it in a way that matters, we will ask you to confirm again before your next order.